Android fsck CVE-2026-45531

Exploitation requires the attacker to already have a low-privilege execution context on the target Android device (consistent with PR:L in the CVSS vector). The attacker must be able to supply or influence the filesystem data processed by read_boot_region in fsck.c - this typically occurs when a privileged process invokes the filesystem checker on attacker-influenced storage. No additional execution privileges beyond this initial foothold are required, and no user interaction is needed once the attacker has local access. Exploitation is non-automatable per SSVC, meaning it cannot be reliably triggered at scale without per-target crafting. Unaffected configurations: devices running Android versions prior to 14 or that have applied the 2026-09-01 security patch level.

The CVSS 7.8 (High) vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H accurately reflects the local-only attack surface but correctly scores full C/I/A impact post-escalation. Requiring local access with low privileges (PR:L) significantly narrows real-world risk compared to remote vulnerabilities - an attacker needs an existing foothold on the device. EPSS at 0.12% (2nd percentile) confirms no current exploitation trend. SSVC rates technical impact as total but automatable as 'no' and exploitation status as 'none', consistent with a local-only, manually triggered attack requiring a crafted filesystem artifact. No CISA KEV listing and no public POC further reduce near-term urgency. The primary concern is chained exploitation: an attacker who has already compromised a low-privilege Android process (e.g., via a browser or app vulnerability) could use this to escape the app sandbox and gain system-level privileges.

An attacker who has already achieved low-privilege code execution on an Android device - for example, via a malicious application or a browser exploit - crafts a malformed filesystem image targeting the read_boot_region parsing path in fsck.c. The heap overflow corrupts memory adjacent to the buffer, allowing the attacker to redirect execution flow and escalate to system-level privileges without any additional user interaction. No public proof-of-concept is currently available, making this primarily a risk in targeted, multi-stage attacks.